studiograph 1.3.48-next.13 → 1.3.48-next.131

package/dist/server/index.js

@@ -4,20 +4,21 @@
  * Hosts:
  *   - Graph API (read-only REST over WorkspaceManager)
  *   - Agent chat via POST /api/chat and SSE GET /api/chat/stream
- *   - App plugins mounted via PluginLoader
+ *   - Static web UI (SvelteKit build) with SPA fallback
  */
 import Fastify from 'fastify';
 import cookie from '@fastify/cookie';
 import cors from '@fastify/cors';
 import websocket from '@fastify/websocket';
+import { sanitize } from './middleware/sanitize.js';
 import { existsSync, readFileSync, createReadStream, statSync } from 'fs';
-import { join, extname } from 'path';
+import { join, extname, resolve, sep } from 'path';
 import { Workspace } from '../core/workspace.js';
 import { AgentOrchestrator } from '../agent/orchestrator.js';
-import { PluginLoader, MIME_TYPES } from './plugin-loader.js';
 import { registerGraphApiRoutes } from './routes/graph-api.js';
 import { registerChatRoutes } from './routes/chat.js';
 import { registerWorkspaceApiRoutes } from './routes/workspace-api.js';
+import { registerHealthApiRoutes } from './routes/health.js';
 import { registerPermissionsApiRoutes } from './routes/permissions-api.js';
 import { registerAuthApiRoutes } from './routes/auth-api.js';
 import { registerGitHttpRoutes } from './routes/git-http.js';
@@ -27,36 +28,106 @@ import { registerMcpRoutes } from './routes/mcp.js';
 import { registerConnectorsApiRoutes } from './routes/connectors-api.js';
 import { registerAssetApiRoutes } from './routes/asset-api.js';
 import multipart from '@fastify/multipart';
-import { registerMeetingIngestRoutes } from './routes/meeting-ingest-api.js';
+import { registerEventIngestRoutes } from './routes/event-ingest-api.js';
 import { registerCaptureRoutes } from './routes/capture-api.js';
 import { registerUrlRoutes } from './routes/url-api.js';
 import { registerMessagesApiRoutes } from './routes/messages-api.js';
-import { AuthService, isAdminOrOwner } from '../services/auth-service.js';
+import { registerConfigApiRoutes } from './routes/config-api.js';
+import { registerSettingsApiRoutes } from './routes/settings-api.js';
+import { registerSecretsApiRoutes } from './routes/secrets-api.js';
+import { registerAuditApiRoutes } from './routes/audit-api.js';
+import { AuthService, isWorkspaceOwner } from '../services/auth-service.js';
 import { MessageService } from '../services/message-service.js';
 import { MemoryService } from '../services/memory-service.js';
 import { WsHub } from './ws-hub.js';
 import { registerWsRoute } from './routes/ws.js';
 import { SessionManager } from './session-manager.js';
 import { YjsManager } from './yjs-manager.js';
-/** Ensure every user has a private "My Entries" collection (idempotent). */
-async function ensureAllPrivateCollections(authService, workspacePath, workspaceManager) {
+import { YjsPersistence, acquireYjsStateLock } from './yjs-persistence.js';
+import { ensurePersonalFolder } from '../services/personal-folder.js';
+/** Ensure every user has a personal "My Entries" folder + admin access on it (idempotent). */
+async function ensureAllPersonalFolders(authService, workspacePath, workspaceManager) {
     const users = authService.listUsers();
     const workspace = new Workspace(workspacePath);
     for (const user of users) {
-        if (workspaceManager.getUserPrivateRepo(user.id))
-            continue;
         try {
-            await workspace.registerRepo({
-                name: `entries-${user.id}`,
-                display_name: 'My Entries',
-                description: `Private entries for ${user.displayName}`,
-                private: true,
-                owner_id: user.id,
-            });
-            workspaceManager.reloadConfig();
+            await ensurePersonalFolder(workspace, authService, user);
         }
-        catch { /* already exists or other issue — skip */ }
+        catch { /* non-fatal — skip and let the user re-authenticate */ }
     }
+    workspaceManager.reloadConfig();
+}
+/** MIME types for static file serving (web UI assets). */
+const MIME_TYPES = {
+    '.html': 'text/html',
+    '.css': 'text/css',
+    '.js': 'application/javascript',
+    '.mjs': 'application/javascript',
+    '.json': 'application/json',
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.gif': 'image/gif',
+    '.svg': 'image/svg+xml',
+    '.ico': 'image/x-icon',
+    '.woff': 'font/woff',
+    '.woff2': 'font/woff2',
+    '.ttf': 'font/ttf',
+    '.otf': 'font/otf',
+    '.webp': 'image/webp',
+    '.avif': 'image/avif',
+    '.mp4': 'video/mp4',
+    '.webm': 'video/webm',
+};
+export function resolveStaticFilePath(webDir, urlPath) {
+    let decodedPath;
+    try {
+        decodedPath = decodeURIComponent(urlPath);
+    }
+    catch {
+        return null;
+    }
+    const filePath = decodedPath === '/' ? '/index.html' : decodedPath;
+    const webRoot = resolve(webDir);
+    const fullPath = resolve(webRoot, `.${filePath}`);
+    if (fullPath !== webRoot && !fullPath.startsWith(webRoot + sep)) {
+        return null;
+    }
+    return fullPath;
+}
+function normalizeOrigin(value) {
+    if (!value)
+        return null;
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return null;
+    }
+}
+export function buildAllowedCorsOrigins(workspaceConfig, port) {
+    const rawOrigins = [];
+    const envOrigins = process.env.STUDIOGRAPH_CORS_ORIGINS;
+    if (envOrigins)
+        rawOrigins.push(...envOrigins.split(',').map(o => o.trim()).filter(Boolean));
+    const configured = workspaceConfig.cors_origins;
+    if (Array.isArray(configured)) {
+        rawOrigins.push(...configured.filter((o) => typeof o === 'string'));
+    }
+    else if (typeof configured === 'string') {
+        rawOrigins.push(...configured.split(',').map(o => o.trim()).filter(Boolean));
+    }
+    const serverUrl = workspaceConfig.server_url;
+    if (typeof serverUrl === 'string')
+        rawOrigins.push(serverUrl);
+    rawOrigins.push(`http://localhost:${port}`, `http://127.0.0.1:${port}`, `http://[::1]:${port}`);
+    return new Set(rawOrigins.map(normalizeOrigin).filter((o) => Boolean(o)));
+}
+export function isCorsOriginAllowed(origin, allowedOrigins) {
+    if (!origin)
+        return true;
+    const normalized = normalizeOrigin(origin);
+    return Boolean(normalized && allowedOrigins.has(normalized));
 }
 /**
  * Auth middleware — validates JWT cookie or Authorization: Bearer <key> header.
@@ -64,7 +135,7 @@ async function ensureAllPrivateCollections(authService, workspacePath, workspace
  * (except auth endpoints and static assets). When no users exist, everything
  * is open (backward compatible).
  */
-function createAuthHook(apiKeys, authService) {
+function createAuthHook(authService) {
     return async (req, reply) => {
         // Always allow auth endpoints
         if (req.url.startsWith('/api/auth/'))
@@ -80,27 +151,22 @@ function createAuthHook(apiKeys, authService) {
         // WebSocket route handles its own auth
         if (req.url.startsWith('/ws'))
             return;
-        // Allow static assets (JS, CSS, fonts, images) — needed for login page
-        if (req.url.startsWith('/_app/') || req.url.startsWith('/api/chrome/'))
+        // Allow static assets (JS, CSS, fonts, images) — needed for login page.
+        // Covers SvelteKit-bundled output under /_app/ and root-level public
+        // files (favicon.ico, studiograph-logomark.svg, …) identified by a file
+        // extension on a non-API GET.
+        if (req.url.startsWith('/_app/'))
+            return;
+        if (req.method === 'GET' &&
+            !req.url.startsWith('/api/') &&
+            extname(req.url.split('?')[0]).length > 1)
             return;
         // Allow HTML page requests (SPA routing) — the app handles auth client-side
         if (req.method === 'GET' && req.headers.accept?.includes('text/html'))
             return;
-        // If no users configured, allow everything (open mode)
-        if (!authService.hasUsers()) {
-            // Still check API keys for programmatic routes if configured
-            if (apiKeys.length > 0) {
-                const authHeader = req.headers['authorization'];
-                const bearer = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : undefined;
-                if (bearer && apiKeys.includes(bearer))
-                    return;
-                // For non-API routes (i.e. browser requests), allow without auth
-                if (!req.url.startsWith('/api/') || req.url.startsWith('/api/auth/'))
-                    return;
-                // For API routes without a bearer token, allow if no users exist
-            }
+        // If no users configured, allow everything (open mode — single-tenant dev)
+        if (!authService.hasUsers())
             return;
-        }
         // Check JWT cookie (web UI sessions)
         const jwtToken = req.cookies?.['__sg_token'];
         if (jwtToken) {
@@ -110,11 +176,26 @@ function createAuthHook(apiKeys, authService) {
                 return;
             }
         }
-        // Check Bearer token (API clients, MCP)
+        // Check Bearer token (API clients, MCP, CLI): JWT → per-user API token.
+        // Both yield a user identity. There is no shared workspace key — every
+        // caller must be identifiable so access control can enforce per-folder rules.
         const authHeader = req.headers['authorization'];
         const bearer = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : undefined;
-        if (bearer && apiKeys.includes(bearer))
-            return;
+        if (bearer) {
+            const jwtUser = authService.verifyToken(bearer);
+            if (jwtUser) {
+                req.user = jwtUser;
+                return;
+            }
+            const tokenMeta = authService.verifyApiTokenWithMeta(bearer);
+            if (tokenMeta) {
+                req.user = tokenMeta.user;
+                // Stash the token's user-set name so downstream surfaces (MCP, agent
+                // activity) can label the integration. Absent for cookie/JWT auth.
+                req.apiTokenName = tokenMeta.tokenName;
+                return;
+            }
+        }
         // Check Basic Auth (CLI join command)
         if (authHeader?.startsWith('Basic ')) {
             try {
@@ -133,22 +214,128 @@ function createAuthHook(apiKeys, authService) {
         return reply.status(401).send({ error: 'Unauthorized' });
     };
 }
+/**
+ * Phase 11 — preSerialization payload sanitizer.
+ *
+ * The API has many routes that respond with `{ error: err.message }` from a
+ * catch block. Those messages can carry upstream provider errors, git
+ * stderr (with embedded credentials), or other free-form text that we
+ * don't want surfacing in HTTP responses. Walk the response payload,
+ * sanitize any string value at a "message" / "error" / "detail" key,
+ * and leave structured fields (status codes, IDs, classification flags)
+ * alone.
+ *
+ * Conservatively, we ONLY redact at keys that conventionally carry
+ * free-form text. Arbitrary string fields (entity names, IDs, etc.) are
+ * left untouched so we don't garble legitimate content. The Fastify
+ * logger sanitization (above) handles log-line redaction independently;
+ * this hook focuses on the wire response.
+ */
+const FREEFORM_ERROR_KEYS = new Set(['error', 'message', 'detail', 'stack', 'description', 'error_description']);
+function sanitizeResponsePayload(value) {
+    if (typeof value === 'string')
+        return sanitize(value);
+    if (Array.isArray(value))
+        return value.map(sanitizeResponsePayload);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            if (FREEFORM_ERROR_KEYS.has(k) && typeof v === 'string') {
+                out[k] = sanitize(v);
+            }
+            else if (v && typeof v === 'object') {
+                out[k] = sanitizeResponsePayload(v);
+            }
+            else {
+                out[k] = v;
+            }
+        }
+        return out;
+    }
+    return value;
+}
 export async function createServer(config) {
+    // Phase 11: every Fastify log line flows through sanitize() before
+    // reaching stdout. A thin Writable wrapper passes each chunk through
+    // the redactor; pino accepts any `stream` with a `write()` method.
+    // STUDIOGRAPH_LOG_RAW=1 disables redaction for local debugging.
+    const shouldRedactFastifyLogs = process.env.STUDIOGRAPH_LOG_RAW !== '1' &&
+        (process.env.NODE_ENV === 'production' || !!process.env.RAILWAY_ENVIRONMENT);
+    const redactingStream = {
+        write(chunk) {
+            const out = shouldRedactFastifyLogs ? sanitize(chunk) : chunk;
+            process.stdout.write(out);
+        },
+    };
     const fastify = Fastify({
         logger: process.env.STUDIOGRAPH_LOG === '1'
-            ? true
-            : { level: 'warn' },
+            ? { stream: redactingStream }
+            : { level: 'warn', stream: redactingStream },
         bodyLimit: 10 * 1024 * 1024, // 10 MB — entities can be large (e.g. meeting transcripts)
     });
+    // Phase 11: sanitize uncaught errors before serialization so neither
+    // err.message nor err.stack echoes upstream secrets. Stable error
+    // codes (err.code) pass through; we only redact freeform text.
+    fastify.setErrorHandler((error, _req, reply) => {
+        const sanitizedMsg = shouldRedactFastifyLogs ? sanitize(error.message) : error.message;
+        const status = error.statusCode ?? 500;
+        fastify.log.error({
+            err: { message: sanitizedMsg, code: error.code },
+        });
+        reply.status(status).send({
+            statusCode: status,
+            code: error.code,
+            error: status >= 500 ? 'Internal Server Error' : (error.name || 'Error'),
+            message: status >= 500 ? 'An internal error occurred.' : sanitizedMsg,
+        });
+    });
+    // Phase 11: pre-serialization hook scans every response body for
+    // freeform error/message strings and runs them through sanitize().
+    // This catches the many `reply.status(4xx).send({ error: err.message })`
+    // call sites scattered across the API routes — without this, an
+    // upstream provider error or git remote error would echo through to
+    // the API consumer with embedded credentials. Stable error codes pass
+    // through unchanged. Only kicks in when redaction is enabled.
+    if (shouldRedactFastifyLogs) {
+        fastify.addHook('preSerialization', async (_req, _reply, payload) => {
+            if (!payload || typeof payload !== 'object')
+                return payload;
+            return sanitizeResponsePayload(payload);
+        });
+    }
     // CORS
+    const allowedCorsOrigins = buildAllowedCorsOrigins(config.workspaceConfig, config.port);
     await fastify.register(cors, {
-        origin: true,
+        origin: (origin, cb) => {
+            cb(null, isCorsOriginAllowed(origin, allowedCorsOrigins));
+        },
         credentials: true,
     });
     // Cookie support for web UI session auth
     await fastify.register(cookie);
-    // WebSocket support for real-time notifications
-    await fastify.register(websocket);
+    // WebSocket support for real-time notifications.
+    //
+    // perMessageDeflate is enabled here on purpose. Our origin would otherwise
+    // leave compression off (ws lib default), but Railway's edge proxy
+    // negotiates `permessage-deflate` with the browser anyway and does its own
+    // inflate/deflate layer in the middle — which Safari/WebKit mis-decodes,
+    // producing truncated buffers and `RangeError: Length out of range of buffer`
+    // inside Yjs's varint reader, followed by WS disconnect loops.
+    //
+    // Negotiating compression at the origin forces end-to-end deflate (Node's
+    // zlib ↔ browser) and prevents the proxy from inserting its own layer.
+    // `noContextTakeover` on both sides keeps each frame independently
+    // decompressible, which avoids cross-frame state bugs that have historically
+    // hit Safari.
+    await fastify.register(websocket, {
+        options: {
+            perMessageDeflate: {
+                threshold: 1024,
+                serverNoContextTakeover: true,
+                clientNoContextTakeover: true,
+            },
+        },
+    });
     // Multipart support for file uploads (images, assets)
     await fastify.register(multipart, { limits: { fileSize: 10 * 1024 * 1024 } });
     fastify.addContentTypeParser('application/json', { parseAs: 'buffer' }, (req, body, done) => {
@@ -169,28 +356,76 @@ export async function createServer(config) {
             done(null); // Don't consume the body — the route handler pipes req.raw directly
         });
     }
-    // Initialize auth service, WebSocket hub, session manager, and collab server
-    const authService = new AuthService(config.workspacePath);
-    // Ensure API key is committed to auth-seed.json so `studiograph pull` can use it
-    authService.syncApiKeyToSeed();
-    // Ensure all users have their private "My Entries" collection
-    await ensureAllPrivateCollections(authService, config.workspacePath, config.workspaceManager);
-    const wsHub = new WsHub();
+    // Initialize auth service, WebSocket hub, session manager, and collab server.
+    // Phase 8: when the boot path provided master-key options, hand them through
+    // so OAuth tokens + per-user secret prefs use the encrypted column path.
+    const authService = new AuthService(config.workspacePath, config.authCryptoOptions);
+    // Ensure all users have their personal "My Entries" folder
+    await ensureAllPersonalFolders(authService, config.workspacePath, config.workspaceManager);
+    const { getCurrentVersion } = await import('../utils/version-checker.js');
+    const wsHub = new WsHub(getCurrentVersion());
     const messageService = new MessageService(config.workspacePath);
     const sessionManager = new SessionManager(config.workspaceManager, wsHub);
-    const yjsManager = new YjsManager(config.workspaceManager);
+    // Recover any dirty repos before accepting requests. Replays persisted
+    // pending commits from a previous process AND sweeps every working tree
+    // for uncommitted state. Catches anything dropped by a crash, OOM, or
+    // hard restart. Logs and continues on failure — recovery is best-effort
+    // and must never block server startup.
+    try {
+        await sessionManager.recoverOnBoot();
+    }
+    catch (err) {
+        console.warn('[server] sessionManager.recoverOnBoot failed:', err.message);
+    }
+    // Persistence layer: durable Y.Doc snapshot store across server restarts.
+    // Lives at `<workspace>/.studiograph/yjs-state/` — gitignored binary state
+    // separate from the .md files (which remain canonical for git, MCP, agents).
+    // See yjs-persistence.ts for the file format and concurrency model.
+    const yjsStateDir = join(config.workspacePath, '.studiograph', 'yjs-state');
+    // Single-instance lock. Throws if another studiograph server is already
+    // running against this workspace. We don't support horizontal scaling today
+    // (no shared Yjs pubsub), so the safe default is to fail fast on misuse
+    // rather than silently corrupt snapshots via concurrent writers.
+    const releaseYjsLock = acquireYjsStateLock(yjsStateDir);
+    const yjsPersistence = new YjsPersistence(yjsStateDir);
+    const yjsManager = new YjsManager(config.workspaceManager, yjsPersistence);
+    // Wire the Yjs persistence layer to follow structural .md mutations.
+    // delete / rename / changeType all change a doc's identity (path on disk
+    // and its docName), so the snapshot file has to move with it. Without
+    // these hooks, snapshots leak (orphaned files for deleted entities) or
+    // serve stale state at the new identity (ghost content after a rename).
+    config.workspaceManager.setGraphMutationCallbacks({
+        onDelete: (repo, entityType, entityId) => yjsPersistence.delete(`${repo}/${entityType}/${entityId}`),
+        onRename: (repo, entityType, oldId, newId) => yjsPersistence.rename(`${repo}/${entityType}/${oldId}`, `${repo}/${entityType}/${newId}`),
+        onChangeType: (repo, entityId, fromType, toType) => yjsPersistence.rename(`${repo}/${fromType}/${entityId}`, `${repo}/${toType}/${entityId}`),
+        // Smart-merge the just-written .md content into the active Y.Doc. Without
+        // this, server-side bypass writes (MCP update_entity, agent tools,
+        // event processor) get silently overwritten by the next autosave PUT
+        // carrying stale Y.Text content. Sync — must complete before any await
+        // yields in graph.update so a concurrent autosave can't race in.
+        onContentUpdate: (repo, entityType, entityId) => yjsManager.syncDocFromDisk(`${repo}/${entityType}/${entityId}`),
+    });
     // Register auth API routes (before the auth hook so they are always accessible)
     await registerAuthApiRoutes(fastify, authService, config.workspacePath, config.workspaceManager, config.workspaceConfig.team_name);
     // Auth hook — applied to all routes
-    const authHook = createAuthHook(config.apiKeys, authService);
+    const authHook = createAuthHook(authService);
     fastify.addHook('preHandler', authHook);
     // Register WebSocket route (real-time change notifications + cursor broadcasting)
-    await registerWsRoute(fastify, wsHub, authService, yjsManager);
-    // Register graph API routes (with per-collection access filtering)
-    await registerGraphApiRoutes(fastify, config.workspaceManager, authService, wsHub, sessionManager);
+    await registerWsRoute(fastify, wsHub, authService, config.workspaceManager, yjsManager);
+    // Register graph API routes (with per-folder access filtering)
+    await registerGraphApiRoutes(fastify, config.workspaceManager, authService, wsHub, sessionManager, yjsManager);
     // Register workspace API routes (git operations)
-    await registerWorkspaceApiRoutes(fastify, config.workspaceManager, config.gitUser);
-    // Register permissions API routes (self-hosted collection access)
+    await registerWorkspaceApiRoutes(fastify, config.workspaceManager, config.gitUser, authService);
+    // Register health endpoints (per-repo dirty status)
+    await registerHealthApiRoutes(fastify, config.workspaceManager, sessionManager);
+    // Register config + workspace data API routes (for `studiograph push/pull --remote`)
+    await registerConfigApiRoutes(fastify, config.workspaceManager, config.workspacePath, authService);
+    // Register Phase 7 settings/secrets/audit API routes. Owner-only via
+    // isWorkspaceOwner() inside each handler.
+    await registerSettingsApiRoutes(fastify, authService);
+    await registerSecretsApiRoutes(fastify, authService);
+    await registerAuditApiRoutes(fastify, authService);
+    // Register permissions API routes (self-hosted folder access)
     await registerPermissionsApiRoutes(fastify, authService, config.workspaceManager, wsHub);
     // Messages API routes registered after agent init (below) so @agent invocation works
     // Register connectors API routes (MCP connector management + OAuth)
@@ -236,7 +471,21 @@ export async function createServer(config) {
     await registerBriefingApiRoutes(fastify, config.workspaceManager, authService, config.workspacePath, wsHub, getToolsForUser);
     // Background briefing refresh — check staleness for online users every heartbeat tick
     {
-        const BRIEFING_MAX_AGE_MS = 24 * 60 * 60 * 1000; // 24 hours
+        /** Format a Date as YYYY-MM-DD in the given IANA timezone. Falls back to
+         *  UTC when the timezone is invalid so we never crash on bad input. */
+        const localDateIn = (d, tz) => {
+            try {
+                return new Intl.DateTimeFormat('en-CA', {
+                    timeZone: tz,
+                    year: 'numeric',
+                    month: '2-digit',
+                    day: '2-digit',
+                }).format(d);
+            }
+            catch {
+                return d.toISOString().slice(0, 10);
+            }
+        };
         const loadWsConfig = () => {
             const cfgPath = join(config.workspacePath, '.studiograph', 'workspace.json');
             if (!existsSync(cfgPath))
@@ -252,22 +501,26 @@ export async function createServer(config) {
             const allRepos = config.workspaceManager.getAllRepoConfigs();
             const user = authService.findUserById(userId);
             if (!user)
-                return allRepos.filter(r => !r.private).map(r => r.name);
-            if (isAdminOrOwner(user.role))
-                return allRepos.filter(r => !r.private || r.owner_id === user.id).map(r => r.name);
-            const allowed = new Set(authService.getUserCollections(user.id));
-            return allRepos.filter(r => (r.private && r.owner_id === user.id) || allowed.has(r.name)).map(r => r.name);
+                return allRepos.filter(r => !r.personal).map(r => r.name);
+            // Folder membership is the sole source of truth — no role-based short-circuit.
+            const allowed = new Set(authService.getUserFolders(user.id));
+            return allRepos.filter(r => allowed.has(r.name)).map(r => r.name);
         };
-        wsHub.setBriefingRefresh((userId) => {
+        wsHub.setBriefingRefresh((userId, tz) => {
             const brief = authService.getHomeBrief(userId);
             if (!brief)
                 return false;
             // Always regenerate if no briefing text exists yet (migration from old insights system)
             const cached = authService.getCachedBriefing(userId);
-            if (!cached.briefingText)
+            if (!cached.briefingText || !cached.generatedAt)
                 return true;
-            const age = authService.getCachedBriefingAge(userId);
-            return age === null || age > BRIEFING_MAX_AGE_MS;
+            // Stale when the cached briefing was generated on an earlier calendar
+            // date in the user's local timezone. This anchors "daily briefing"
+            // to the user's morning rather than a rolling 24h window, and aligns
+            // with the chat session's local-calendar-day rollover.
+            const cachedLocal = localDateIn(new Date(cached.generatedAt), tz);
+            const todayLocal = localDateIn(new Date(), tz);
+            return cachedLocal < todayLocal;
         }, async (userId) => {
             const brief = authService.getHomeBrief(userId);
             const repoNames = getReposForUser(userId);
@@ -283,43 +536,11 @@ export async function createServer(config) {
             }
         });
     }
-    // Register meeting ingest API (Chrome extension + other capture tools)
-    await registerMeetingIngestRoutes(fastify, config.workspaceManager, authService, wsHub);
+    // Register event ingest API (meeting capture from Chrome extension + desktop tray)
+    await registerEventIngestRoutes(fastify, config.workspaceManager, authService, wsHub, yjsManager);
     // Register MCP Streamable HTTP endpoint
-    await registerMcpRoutes(fastify, config.workspaceManager, authService);
-    // Serve chrome assets (shared header/footer for app editors)
-    const chromeDir = join(import.meta.dirname, 'chrome');
-    if (existsSync(chromeDir)) {
-        const CHROME_MIME = { '.js': 'application/javascript', '.css': 'text/css' };
-        fastify.get('/api/chrome/:file', async (req, reply) => {
-            const file = req.params.file;
-            if (file.includes('..') || file.includes('/')) {
-                return reply.status(400).send({ error: 'Invalid path' });
-            }
-            const filePath = join(chromeDir, file);
-            if (!existsSync(filePath) || !statSync(filePath).isFile()) {
-                return reply.status(404).send({ error: 'Not found' });
-            }
-            const ext = extname(filePath).toLowerCase();
-            reply.type(CHROME_MIME[ext] || 'application/octet-stream');
-            reply.header('Cache-Control', 'public, max-age=300');
-            return reply.send(createReadStream(filePath));
-        });
-    }
-    // Discover installed apps and collect their skill/tool dirs
-    const loader = new PluginLoader();
-    const manifests = loader.loadApps(config.appsDir);
-    const appSkillsDirs = [];
-    const appToolsDirs = [];
-    for (const manifest of manifests) {
-        const skillsDir = loader.getSkillsDir(config.appsDir, manifest);
-        if (skillsDir)
-            appSkillsDirs.push(skillsDir);
-        const toolsDir = loader.getToolsDir(config.appsDir, manifest);
-        if (toolsDir)
-            appToolsDirs.push(toolsDir);
-    }
-    // Initialize memory service and agent — non-fatal so the server can still serve graph API and apps
+    await registerMcpRoutes(fastify, config.workspaceManager, authService, wsHub);
+    // Initialize memory service and agent — non-fatal so the server can still serve graph API
     const memoryService = new MemoryService();
     let agent = null;
     try {
@@ -328,13 +549,16 @@ export async function createServer(config) {
             workspacePath: config.workspacePath,
             workspaceConfig: config.workspaceConfig,
             gitUser: config.gitUser,
-            skillsDirs: appSkillsDirs,
-            toolsDirs: appToolsDirs,
             recentMemory,
             workspaceManager: config.workspaceManager,
             messageService,
+            // Y.Doc reconciliation now happens at the graph layer via the
+            // onContentUpdate callback (see setGraphMutationCallbacks above).
+            // Every graph.update() that doesn't explicitly opt out of Yjs sync
+            // (skipYjsSync) fires it, so the agent gets it for free without
+            // wiring an orchestrator-level hook.
         });
-        await registerChatRoutes(fastify, agent, memoryService);
+        await registerChatRoutes(fastify, agent, wsHub, authService, memoryService);
         await registerCaptureRoutes(fastify, agent);
         await registerUrlRoutes(fastify);
     }
@@ -358,63 +582,30 @@ export async function createServer(config) {
     let heartbeatService = null;
     try {
         const { HeartbeatService } = await import('../services/heartbeat.js');
-        heartbeatService = new HeartbeatService(messageService, config.workspaceManager, wsHub, config.workspaceConfig);
+        heartbeatService = new HeartbeatService(messageService, config.workspaceManager, wsHub, agent ?? null);
         heartbeatService.start();
     }
     catch (err) {
         fastify.log.warn(`Heartbeat not available: ${err.message}`);
     }
-    // Register messages API routes (collection-scoped messaging with @agent support)
+    // Register messages API routes (folder-scoped messaging with @agent support)
     await registerMessagesApiRoutes(fastify, messageService, authService, wsHub, config.workspaceManager, agent, heartbeatService);
-    // GET /api/apps — list installed app manifests with resolved entity type names
-    const resolvedApps = manifests.map(m => {
-        let entityTypes = [];
-        try {
-            const etPath = join(config.appsDir, m.name, m.entityTypes);
-            if (existsSync(etPath)) {
-                const raw = JSON.parse(readFileSync(etPath, 'utf-8'));
-                if (Array.isArray(raw)) {
-                    entityTypes = raw.map((item) => item.name).filter(Boolean);
-                }
-            }
-        }
-        catch {
-            // gracefully degrade — return empty array
-        }
-        return { name: m.name, version: m.version, description: m.description, mountPath: m.mountPath, entityTypes };
-    });
-    fastify.get('/api/apps', async (_req, reply) => {
-        return reply.send(resolvedApps);
-    });
     // GET /api/workspace — workspace metadata
     fastify.get('/api/workspace', async (_req, reply) => {
         const workspace = new Workspace(config.workspacePath);
         const about = workspace.loadAbout();
-        return reply.send({ name: config.workspaceConfig.team_name, about, accent_color: config.workspaceConfig.accent_color ?? null });
+        return reply.send({ name: config.workspaceConfig.team_name, about });
     });
-    // PUT /api/workspace — update workspace identity (admin only)
+    // PUT /api/workspace — update workspace identity (owner only)
     fastify.put('/api/workspace', async (req, reply) => {
         const user = req.user;
-        if (user && !isAdminOrOwner(user.role)) {
-            return reply.status(403).send({ error: 'Admin access required' });
+        if (user && !isWorkspaceOwner(user.role)) {
+            return reply.status(403).send({ error: 'Workspace owner access required' });
         }
-        const { name, about, accent_color } = req.body ?? {};
+        const { name, about } = req.body ?? {};
         const workspace = new Workspace(config.workspacePath);
-        let configChanged = false;
         if (typeof name === 'string' && name.trim()) {
             config.workspaceConfig.team_name = name.trim();
-            configChanged = true;
-        }
-        if (accent_color !== undefined) {
-            if (accent_color === null) {
-                delete config.workspaceConfig.accent_color;
-            }
-            else {
-                config.workspaceConfig.accent_color = accent_color;
-            }
-            configChanged = true;
-        }
-        if (configChanged) {
             workspace.writeConfig(config.workspaceConfig);
         }
         if (typeof about === 'string') {
@@ -422,24 +613,28 @@ export async function createServer(config) {
         }
         return reply.send({ success: true });
     });
-    // GET /api/workspace/mcp-config — MCP client configuration snippet (all authenticated users)
+    // GET /api/workspace/mcp-config — MCP client configuration snippet.
+    // Returns a template with `<your-token-here>` in the Authorization header;
+    // the frontend fills it in after the user mints a personal token via
+    // POST /api/auth/tokens. We never embed a shared key here because doing so
+    // would leak a workspace-wide credential and re-introduce the bug the
+    // per-user-token model exists to solve.
     fastify.get('/api/workspace/mcp-config', async (req, reply) => {
         const proto = req.headers['x-forwarded-proto'] === 'https' ? 'https' : (req.protocol ?? 'http');
         const host = req.headers['x-forwarded-host'] || req.headers.host || 'localhost';
         const baseUrl = `${proto}://${host}`;
-        const apiKey = authService.getApiKey();
         const mcpConfig = {
             mcpServers: {
                 studiograph: {
                     type: 'streamable-http',
                     url: `${baseUrl}/mcp`,
                     headers: {
-                        Authorization: `Bearer ${apiKey}`,
+                        Authorization: 'Bearer <your-token-here>',
                     },
                 },
             },
         };
-        return reply.send({ config: mcpConfig });
+        return reply.send({ config: mcpConfig, url: `${baseUrl}/mcp` });
     });
     // DELETE /api/memory — clear all agent memory files
     fastify.delete('/api/memory', async (_req, reply) => {
@@ -451,19 +646,6 @@ export async function createServer(config) {
         const count = agent?.clearSessions() ?? 0;
         return reply.send({ cleared: count });
     });
-    // Mount app plugins
-    for (const manifest of manifests) {
-        try {
-            await loader.mountPlugin(fastify, manifest, config.appsDir, {
-                workspaceManager: config.workspaceManager,
-                gitUser: config.gitUser,
-            });
-            fastify.log.info(`Mounted app "${manifest.name}" at ${manifest.mountPath}`);
-        }
-        catch (err) {
-            fastify.log.error(err, `Failed to mount app "${manifest.name}"`);
-        }
-    }
     // Serve web UI static files from dist/web/ with SPA fallback
     // When running via tsx from source, import.meta.dirname is src/server/ so ../web doesn't exist.
     // Fall back to dist/web/ relative to project root.
@@ -471,12 +653,34 @@ export async function createServer(config) {
     const webDir = existsSync(webDirCandidate) ? webDirCandidate : join(import.meta.dirname, '..', '..', 'dist', 'web');
     if (existsSync(webDir)) {
         const indexPath = join(webDir, 'index.html');
-        // SPA fallback for app routes: if an app plugin returns a JSON error for a
-        // browser GET request, serve the SPA instead. This happens when the browser
-        // refreshes a URL like /documents/document/doc-123 — the app's greedy route
-        // catches it but fails because the params don't match its expectations.
+        // SPA fallback: if any API route returns a JSON error for a browser GET,
+        // serve the SPA instead so client-side routing can handle the URL.
         // Read fresh from disk each time so rebuilds take effect without server restart.
         const readIndexHtml = () => readFileSync(indexPath);
+        /**
+         * Cache policy for static assets:
+         * - `/_app/immutable/*` are content-hashed by SvelteKit, so the URL
+         *   changes every time the file does — safe to cache forever.
+         * - `index.html` (and the SPA fallback) MUST revalidate every load,
+         *   otherwise stale HTML keeps pointing at expired immutable hashes.
+         * - Other root assets (favicons, og images, etc.) get a modest TTL.
+         *
+         * Without these headers the upstream CDN (Fastly in front of Railway)
+         * forwards almost every request to origin, producing multi-second
+         * TTFB on cold edges and a 3-5s "black screen" while the SPA bundle
+         * loads.
+         */
+        function setStaticCacheHeader(reply, urlPath) {
+            if (urlPath.startsWith('/_app/immutable/')) {
+                reply.header('Cache-Control', 'public, max-age=31536000, immutable');
+            }
+            else if (urlPath === '/' || urlPath === '/index.html' || !extname(urlPath)) {
+                reply.header('Cache-Control', 'no-cache');
+            }
+            else {
+                reply.header('Cache-Control', 'public, max-age=3600');
+            }
+        }
         fastify.addHook('onSend', async (request, reply, payload) => {
             if (reply.sent)
                 return payload;
@@ -487,23 +691,24 @@ export async function createServer(config) {
                 typeof ct === 'string' && ct.includes('application/json')) {
                 reply.removeHeader('content-length');
                 reply.code(200).type('text/html');
+                reply.header('Cache-Control', 'no-cache');
                 return readIndexHtml();
             }
             return payload;
         });
-        // Use setNotFoundHandler so app plugins and API routes take priority
+        // Use setNotFoundHandler so API routes take priority over SPA fallback
         fastify.setNotFoundHandler(async (req, reply) => {
             const urlPath = req.url.split('?')[0];
-            const filePath = urlPath === '/' ? '/index.html' : urlPath;
-            const fullPath = join(webDir, filePath);
+            const fullPath = resolveStaticFilePath(webDir, urlPath);
+            if (!fullPath) {
+                return reply.status(400).send({ error: 'Invalid path' });
+            }
             // Serve the file if it exists (and is a file, not directory)
             if (existsSync(fullPath) && statSync(fullPath).isFile()) {
-                if (fullPath.includes('..')) {
-                    return reply.status(400).send({ error: 'Invalid path' });
-                }
                 const ext = extname(fullPath).toLowerCase();
                 const contentType = MIME_TYPES[ext] || 'application/octet-stream';
                 reply.type(contentType);
+                setStaticCacheHeader(reply, urlPath);
                 return reply.send(createReadStream(fullPath));
             }
             // SPA fallback — serve index.html for client-side routing.
@@ -513,18 +718,21 @@ export async function createServer(config) {
             const hasFileExt = extname(urlPath).length > 1;
             if (req.method === 'GET' && !hasFileExt && existsSync(indexPath)) {
                 reply.type('text/html');
+                reply.header('Cache-Control', 'no-cache');
                 return reply.send(createReadStream(indexPath));
             }
             return reply.status(404).send({ error: 'Not found' });
         });
         fastify.log.info('Web UI enabled — serving from dist/web/');
     }
-    // Graceful shutdown
+    // Graceful shutdown — sessionManager.shutdown() flushes pending commits
+    // BEFORE tearing down the timer (the old destroy()-only path could lose
+    // dirty sessions if called without an explicit flush).
     fastify.addHook('onClose', async () => {
-        await sessionManager.flushAll();
-        sessionManager.destroy();
-        yjsManager.destroy();
+        await sessionManager.shutdown();
+        await yjsManager.destroy();
         wsHub.destroy();
+        releaseYjsLock();
     });
     return fastify;
 }